CVE-2018-10099
MEDIUMGoogle Monorail < 2018-04-04 - Cross-Site Request Forgery via CSV Download
Title source: llmDescription
Google Monorail before 2018-04-04 has a Cross-Site Search (XS-Search) vulnerability because CSV downloads are affected by CSRF, and calculations of download times (for requests with duplicated columns) can be used to obtain sensitive information about the content of bug reports.
References (3)
Core 3
Core References
Patch, Vendor Advisory x_refsource_misc
https://chromium.googlesource.com/infra/infra/+/0ff6b6453b6192987bd9240c1e872a7de5fb1313
Exploit, Third Party Advisory x_refsource_misc
https://www.reddit.com/r/netsec/comments/9yiidf/xssearching_googles_bug_tracker_to_find_out/ea2i7wz/
Various Sources x_refsource_misc
https://medium.com/%40luanherrera/xs-searching-googles-bug-tracker-to-find-out-vulnerable-source-code-50d8135b7549
Scores
CVSS v3
5.3
EPSS
0.0034
EPSS Percentile
26.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-352
Status
published
Products (1)
google/monorail
< 2018-04-04
Published
Nov 20, 2018
Tracked Since
Feb 18, 2026